Bug 257176
| Summary: | WebAuthn .create() rejects with "NotAllowedError: Operation Failed" after conditional UI request aborted | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Matthew Miller (Cisco) <matthew> |
| Component: | WebKit Misc. | Assignee: | Abigail F <abifox> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | bfulgham, pascoe, webkit-bug-importer, wilander |
| Priority: | P2 | Keywords: | InRadar |
| Version: | Safari 16 | ||
| Hardware: | Mac (Apple Silicon) | ||
| OS: | macOS 13 | ||
| Bug Depends on: | |||
| Bug Blocks: | 271257 | ||
Matthew Miller (Cisco)
## Context
I'm observing Safari rejecting a call to `navigator.credentials.create()` with "NotAllowedError: Operation Failed" when the active page has an active conditional UI request.
## Environment
- macOS 13.4
- Safari 16.5
## Reproduction Steps
1. Host the following HTML file on http://localhost (see the end of this description)
2. Observe conditional UI is active on the lone text input
3. Open Safari dev tools
4. Click the "Start modal registration" button
5. Observe the expected "AbortError: Aborted by AbortSignal" error
6. After a short delay, observe the unexpected "NotAllowedError: Operation failed" error and no WebAuthn registration modal
7. Refresh the page
8. Click the "Start modal authentication" button
9. Observe the expected "AbortError: Aborted by AbortSignal" error
10. Observe the typical Safari WebAuthn authentication modal
### Sample code
```html
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Document</title>
</head>
<body>
<button id="startReg">Start modal registration</button>
<button id="startAuth">Start modal authentication</button>
<form action="">
<input
type="email"
name="email"
id="email"
autocomplete="webauthn username"
/>
</form>
<script>
const abortController = new AbortController();
// 1. Start conditional UI
navigator.credentials
.get({
publicKey: {
challenge: new Uint8Array(16).fill(0),
allowCredentials: [],
},
mediation: "conditional",
signal: abortController.signal,
})
.then(console.log)
.catch(console.error);
// 2. Click to start modal registration (errors out with "NotAllowedError: Operation Failed")
document.getElementById("startReg").addEventListener("click", () => {
abortController.abort(
new Error("cancelling conditional UI for registration")
);
navigator.credentials.create({
publicKey: {
challenge: new Uint8Array(16).fill(0),
rp: { id: "localhost", name: "localhost" },
user: {
id: new Uint8Array(16).fill(0),
name: "Username",
displayName: "Username",
},
pubKeyCredParams: [{ alg: -7, type: "public-key" }],
},
});
});
// 3. Click to start modal authentication (it works as expected)
document.getElementById("startAuth").addEventListener("click", () => {
abortController.abort(
new Error("cancelling conditional UI for authentication")
);
navigator.credentials.get({
publicKey: {
challenge: new Uint8Array(16).fill(0),
},
});
});
</script>
</body>
</html>
```
## Expected Behavior
I was expecting the conditional UI request to reject with the AbortError, and then Safari to show the typical registration modal.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/109936742>
Abigail F
Pull request: https://github.com/WebKit/WebKit/pull/22983
EWS
Committed 273918@main (ded025f42cde): <https://commits.webkit.org/273918@main>
Reviewed commits have been landed. Closing PR #22983 and removing active labels.